Denial of Service ( Ch 7 )

1. Denial of Service(Ch 7)

2. Denial of Service Attacks • Unlike other forms of computer attacks, goal isn’t access or theft of information or services • The goal is to stop the service from operating • To deny service to legitimate users • Slowing down may be good enough • This is usually a temporary effect that passes as soon as the attack stops

3. How Can a Service Be Denied? • Lots of ways • Crash the machine • Or put it into an infinite loop • Crash routers on the path to the machine • Use up a key machine resource • Use up a key network resource • Deny another service needed for this one (DNS) • Using up resources is the most common approach

4. Simple Denial of Service

5. Simple Denial of Service • One machine tries to bring down another machine • There is a fundamental problem for the attacker: • The attack machine must be “more powerful” than the target machine to overload it OR • Attacker uses approaches other than flooding, e.g., exploit vulnerability at the target • The target machine might be a powerful server • Hard to flood

6. DDoS – Distributed DoS • Use multiple machines to generate the workload • For any server of fixed power, enough attack machines working together can overload it • Enlist lots of machines and coordinate their attack on a single machine • Send any type of traffic, and the attack will work • If you want to be stealthy try to send traffic that looks like legitimate traffic

7. Distributed Denial-of-Service

8. Denial of Service and Asymmetry • Sometimes generating a request is cheaper than formulating a response • sending a bogus packet is cheaper than decrypting this packet and checking that it’s bogus • sending a request to a Web application is cheaper than generating a response via DB lookup • One attack machine can generate a lot of requests, and effectively multiply its power • Not always possible to achieve this asymmetry • This is called amplification effect

9. Denial of Service and IP Spoofing • Attacker can put a fake address in source IP field of the packets (IP spoofing) • Make packets appear to come from many sources • Make packets appear to come from a few select sources (and blame the attack on them) • Make packets appear to come one select source

10. Reflector Attack • Generate service requests to public servers spoofing the victim’s IP • Servers reply back to the victim overwhelming it • E.g., send DNS requests to DNS servers, they reply back to the victim • Usually requests use UDP and ICMP traffic • Often takes advantage of amplification effect • One service request leads to a huge reply or many replies • DNSSEC replies can be 200x larger than requests • Sending a ping packet to a broadcast address may lead to 253 replies back

11. High-level Attack Categorization • Floods • Exhaust bandwidth or CPU or some other limited resource • Congestion control exploits • Make legitimate traffic back off and take long time to ramp up • Unexpected header values, invalid content • Crash OS or application • Invalid fragments, large packets • Crash OS • Impersonation attacks • Take over the target’s DNS name or BGP prefix and draw all their inbound traffic to yourself

12. UDP or ICMP ECHO (Ping) Flood • Attacker sends lots of UDP or ICMP packets • Exhaust the bandwidth • Usually UDP and ICMP make a small part of inbound traffic • We could devise filters that would remove attack and some legitimate traffic (collateral damage) • Usually spoofed traffic

13. TCP SYN Flood • Attacker sends lots of TCP SYN packets • Victim sends an ack, allocates space in memory, attacker never replies • Goal is to fill up memory before entries time out and get deleted • Usually spoofed traffic, or else the attacker’s OS would send a RST and free up memory at the target

14. TCP SYN Flood

15. Small-Packet Floods • Overwhelm routers • Create a lot of packets per second • Exhaust CPU • Most routers can’t handle full bandwidth’s load of small packets • No real solution, must filter packets somehow to reduce router load

16. Shrew Attack • Periodically slam the victim with short, high-volume pulses • Lead to congestion drops on legitimate client’s TCP traffic • TCP backs off to 1 packet per RTT • Attacker slams again after a few RTTs • Solution requires TCP protocol changes • Tough to implement since allclients must be changed

17. Flash-Crowd Attack • Aka application-level flood • Generate legitimate application traffic to the victim • E.g., DNS requests, Web requests, SIP requests • Usually not spoofed but could be if traffic is over UDP • If enough bots are used no client appears too aggressive • Really hard to filter since both traffic and client behavior seem identical between attackers and legitimate users

18. Is DDoS a Real Problem? • Yes, attacks happen every day • One study reported ~4,000 per week1 • Later study reported ~200,000 per week2 • On a wide variety of targets • Tend to be highly successful • There are very few mechanisms that can stop certain attacks • There have been successful attacks on major commercial sites 1”Inferring Internet Denial of Service Activity,” Voelkerand Savage, Usenix Security Symposium, 2002 2”A Macroscopic Characterization of the DoS Ecosystem,” Jonker et al., ACM IMC 2017

19. DDoS on Twitter • August 2009, hours-long service outage • 44 million users affected • At the same time Facebook, LiveJournal, YouTube and Blogger were under attack • Only some users experienced an outage • Real target: a Georgian blogger Image borrowed from Wired.comarticle. Originallyprovided by ArborNetworks

20. DDoS on Mastercard and Visa • December 2010 • Parts of services went down briefly • Attack launched by a group of vigilantes called Anonymous • Bots recruited through social engineering • Directed to download DDoS software and take instructions from a master • Motivation: Payback to services that cut their support of WikiLeaks after their founder was arrested on unrelated charges • Several other services affected

21. DDoS on US Banks • September 2012 • BofA, Chase and Wells Fargo were among those attacked • Services were interrupted • Attack claimed to be launched by a Muslim group Izz ad-Din al Qassam Cyber Fighters • Motivation: outrage about “Innocence of Muslims” movie

22. DDoS on SpamHaus • March 2013 attack on spam blacklisting service • Flood SpamHaus servers using DDoS reflector attack with amplification • SpamHausused CloudFlare to distribute its content – attackers attacked CloudFlare, and then their peers • From 10 to 300 Gbps, lasted several days, knocked out SpamHaus and created congestion in the Internet • Motiv: attackers claimed that Spamhaus wrongly blacklisted their servers

23. DDoS on BBC Web site • Xmas Eve 2015 attack flooding with 600 Gbps • At the same time Donald Trump’s Web site was attacked • Brought down with much smaller volume • New World Hacking claimed responsibility • Proof of concept attack “to show we can” • Site offline at least 3 hours • Allegedly used Amazon’s machines

24. DDoS on Github • March 2018 • 1.3 Tbps reflection attack using memcached • 10 requests per second per server but huge reflection potential • 51,000x • 10 min response from Amazon Prolexic • Attacked stopped soon after • Short attack, probably just a trial

25. Potential Effects of DDoS Attacks • Most (if not all) sites could be rendered non-operational • The Internet could be largely flooded with garbage traffic • Essentially, the Internet could grind to a halt • In the face of a very large attack • Almost any site could be put out of business • With a moderate sized attack

26. Who Is Vulnerable? • Everyone connected to the Internet can be attacked • Everyone who uses Internet for crucial operations can suffer damages

27. But My Machines Are Secured! Doesn’t matter! The problem isn’t your vulnerability, it’s everyone elses’

28. But I Have a Firewall! Either the attacker slips his traffic into legitimate traffic Doesn’t matter! Or he attacks the firewall

29. But I Use a VPN! Doesn’t matter! The attacker can fill your tunnel with garbage Sure, you’ll detect it and discard it . . . But you’ll be so busy doing so that you’ll have no time for your real work

30. But I’m Heavily Provisioned Doesn’t matter! The attacker can probably get enough resources to overcome any level of resources you buy

31. Typical Attack Modus Operandi

32. Attack Toolkits • Widely available on the net • Easily downloaded along with source code • Easily deployed and used • Automated code for: • Scanning – detection of vulnerable machines • Exploit – breaking into the machine • Infection – placing the attack code • Rootkits • Hide the attack code, restart it • Keep open backdoors for attacker access • DDoS attack code

33. DDoS Attack Code • Attacker can customize: • Type of attack • UDP flood, ICMP flood, TCP SYN flood, Smurf attack (broadcast ping flood) • Web server request flood, authentication request flood, DNS flood • Victim IP address • Duration • Packet size • Source IP spoofing • Dynamics (constant rate or pulsing) • Communication between master and slaves (used to be via custom protocol, then via IRC, nowadays via P2P or stealthy messages to Web servers)

34. Implications Of Attack Toolkits • You don’t need much knowledge or great skills to perpetrate DDoS • Toolkits allow unsophisticated users to become DDoS perpetrators in little time • DDoS is, unfortunately, a game anyone can play

35. DDoS Attack Trends • Attackers follow defense approaches, adjust their code to bypass defenses • Use of encryption and decoy packets, IRC or P2P obscures master-slave communication • Encryption of attack packets defeats traffic analysis and signature detection • Pulsing attacks defeat slow defenses and traceback • Flash-crowd attacks generate legitimate (well-formed) application traffic • Use of large botnets makes attackers hard to spot • Social-network recruitment

36. Try To DoS A Server • Log on to DeterLab and then log on to • attacker.exp[1-4].USC430 • Try wget server • Can you get a reply? • Now try the following command: flooder --dst 10.1.2.2 –highrate 1000000 • Try wgetserver again • Can you get a reply?

37. Why Is DDoS Hard to Solve? • A simple form of attack • Designed to prey on the Internet’s strengths • Easy availability of attack machines • Attack can look like normal traffic • Lack of Internet enforcement tools • Hard to get cooperation from others • Effective solutions hard to deploy

38. 1. Simplicity Of Attack • Basically, just send someone a lot of traffic • More complicated versions can add refinements, but that’s the crux of it • No need to find new vulnerabilities • No need to worry about timing, tracing, etc. • Toolkits are readily available to allow the novice to perform DDoS • Even distributed parts are very simple

39. 2. Preys On Internet’s Strengths • The Internet was designed to deliver lots of traffic • From lots of places, to lots of places • DDoS attackers want to deliver lots of traffic from lots of places to one place • Any individual packet can look proper to the Internet • Without sophisticated analysis, even the entire flow can appear proper

40. Internet Resource Utilization • Internet was not designed to monitor resource utilization • Most of it follows first come, first served model • Many network services work the same way • And many key underlying mechanisms do, too • Thus, if a villain can get to the important resources first, he can often deny them to good users

41. 3. Availability Of Attack Machines • DDoS is feasible because attackers can enlist many machines • Attackers can enlist many machines because many machines are readily vulnerable • Not hard to find 1,000 crackable machines on the Internet • Particularly if you don’t care which 1,000 • Botnets numbering hundreds of thousands of hosts have been discovered

42. Can’t We Fix These Vulnerabilities? • DDoS attacks don’t really harm the attacking machines • Many people don’t protect their machines even when the attacks can harm them • Why will they start protecting their machines just to help others? • Altruism has not yet proven to be a compelling argument for for network security

43. 4. Attacks Resemble Normal Traffic • A DDoS attack can consist of vast number of requests for a web server’s home page • No need for attacker to use particular packets or packet contents • So neat filtering/signature tools may not help • Attacker can be arbitrarily sophisticated at mirroring legitimate traffic • In principle • Not often done because dumb attacks work so well

44. 5. Lack Of Enforcement Tools • DDoS attackers have never been caught by tracing or observing attack • Only by old-fashioned detective work • Really, only when they’re dumb enough to boast about their success • The Internet offers no help in tracing a single attack stream, much less multiple ones • Even if you trace them, a clever attacker leaves no clues of his identity on those machines

45. What Is the Internet Lacking? • No validation of IP source address (allows spoofing) • No enforcement of amount of resources used • No method of tracking attack flows • Or those controlling attack flows • No method of assigning responsibility for bad packets or packet streams • No mechanism or tools for determining who corrupted a machine

46. 6. Poor Cooperation In the Internet • It’s hard to get anyone to help you stop or trace or prevent an attack • Even your ISP might not be too cooperative • Anyone upstream of your ISP is less likely to be cooperative • ISPs more likely to cooperate with each other, though • Even if cooperation occurs, it occurs at human timescales • The attack might be over by the time you figure out who to call

47. 7. Effective Solutions Hard To Deploy • The easiest place to deploy defensive systems is near your own machine • Defenses there might not work well (firewall example) • There are effective research solutions • But they require deployment near attackers or in the Internet core • Or, worse, in many places • A working solution is useless without deployment • Hard to get anything deployed if deploying site gets no direct advantage

48. Defenses Against DDoS • A few operational defenses in use today • Many research defenses • Not in active use • Some require large changes to the Internet and may never be in use • DDoS is still a big problem that is costly to solve • We look next into big categories of defense approaches • Many solutions in each category

49. Resource Limitations • Don’t allow an individual attack machine to use many of target’s resources • Each client gets a fair share • Requires: • Authentication (establish client identity), or • Making the client do some work first to “pay” for service • Authentication is hard if there is IP spoofing • Could be possible if TCP is used • Or we need separate authentication solution • Existing clients must be changed to handle special work

50. Hiding From the Attacker • Make it hard for anyone but legitimate clients to deliver messages at all • E.g., keep server’s identity obscure • A possible solution for some potential targets • But not for others, like public web servers • To the extent that approach relies on secrecy, it’s fragile • Security through obscurity